Skip to main content
Submit a request

Free SSL (AutoSSL) and how to force HTTPS

Maxim Tsitsejev
Updated

Applies to: All plans

Before you start: You need access to your client area (my.maxinodes.com) so you can open your service and Log in to cPanel by single sign-on.

Every Maxinodes site gets a free SSL certificate automatically. We use AutoSSL (Let's Encrypt), which is issued for you when your account is set up and renews itself before it expires — you do not need to buy or install anything. This article shows how to confirm your certificate is active, reissue it if needed, redirect visitors from HTTP to HTTPS, and fix "Not secure" warnings.

Note: SSL only works once your domain points to us. If you have just moved in, make sure your domain uses our nameservers, ns1.maxinodes.com and ns2.maxinodes.com, and that DNS has propagated. AutoSSL cannot issue a certificate until the domain resolves to our server.

Check that your SSL certificate is active

  1. Open your site in a browser and look at the address bar. A padlock and an https:// address mean your certificate is working.
  2. To check inside cPanel, log in to your client area, open your hosting service, and select Log in to cPanel.
  3. In cPanel, go to Security -> SSL/TLS Status. Your domains should show as secured by AutoSSL.

Result: Your domain is listed as covered, and the certificate has a future expiry date.

Reissue AutoSSL manually

AutoSSL renews on its own, but you can trigger it manually if a domain shows as not secured (for example, just after you added a new addon domain or subdomain).

  1. In cPanel, go to Security -> SSL/TLS Status.
  2. Tick the domains you want to cover.
  3. Select Run AutoSSL.

Result: cPanel checks the domains and issues or renews certificates. This can take a few minutes.

Force HTTP to HTTPS

Once your certificate is active, redirect all visitors to the secure version so nobody lands on the insecure http:// page.

  1. In cPanel, go to Domains.
  2. Find your domain and switch on the Force HTTPS Redirect toggle.

Result: Visitors who type http:// are sent automatically to https://.

If your application needs its own redirect, you can instead add this to the top of the .htaccess file in your site's document root using File Manager:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Some platforms (such as WordPress) also have their own site-address/HTTPS setting — set that to your https:// address too.

Fix "Not secure" or mixed-content warnings

If the padlock is missing or your browser says the page is only "partly secure", the page is usually loading some assets (images, scripts, stylesheets) over hard-coded http:// links.

  1. Confirm the certificate itself is active using the steps above.
  2. View your page source and search for http:// links pointing at your own domain.
  3. Update those links to https:// (or to protocol-relative //) in your content, theme, or settings.
  4. On WordPress, a search-and-replace plugin can fix http:// references across the database in one pass.

Result: The browser shows a clean padlock with no mixed-content warning.

Troubleshooting this task

  • Certificate will not issue: The domain must point to our nameservers and resolve to our server before AutoSSL can validate it. Check your nameservers first.
  • Site still loads on http://: Clear your browser cache, then re-check the Force HTTPS Redirect toggle. CDN or caching plugins can serve an old non-redirected copy.
  • Padlock shows but one page is insecure: That single page has a hard-coded http:// asset — find and update it as above.
  • New subdomain or addon domain not covered: Run AutoSSL manually for that domain.

Related articles

Comments

0 comments

Please sign in to leave a comment.